Re: [PATCH v2 01/13] cred: gather the rules for acting on a task by uid

[sashiko-bot@kernel.org]

> A number of operations let one task act on another without any capability,
> because the two belong to the same user: signals, scheduling attributes,
> priorities, resource limits, ptrace and more. Each of them compares the
> ids of the two credentials by hand. There are twelve such places, in six
> flavours that differ in which ids they look at, and nothing says that they
> belong together.
> 
> That makes them hard to review and hard to change. Nobody can tell from
> one of them whether it differs from its neighbour on purpose. Whoever
> wants to know what an equal uid is good for has to find all twelve, and so
> does whoever has to change it. A place that is overlooked is a hole.
> 
> Gather the rules in kernel/cred.c, side by side:
> 
>  rule     of the subject    of the object      euid 0 used for
> [ ... ]
> goes with the operation, remain with the caller.
> 
> The callers are converted one by one in the patches that follow.
> 
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104-b4-cred-ids-v2-0-956213608f16@toxicpanda.com?part=1